---
id: CVE-2026-71297
title: A flaw was found in the maestro gRPC broker
summary: >-
  A flaw was found in the maestro gRPC broker. This vulnerability allows a
  remote attacker, with a valid client certificate, to bypass authentication.
  This bypass enables the attacker to subscribe to other consumers' event
  streams, leading…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-306
vendor: Red Hat
product: multicluster-engine/cloudevents-conductor-rhel9
affected:
  - multicluster-engine/cloudevents-conductor-rhel9 (all versions)
  - multicluster-engine/maestro-rhel9 (all versions)
published: '2026-10-05'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T15:17:19.260'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71297'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-71297'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2511518'
    label: secalert@redhat.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-71297.json
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-71297'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71297'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-06T14:42:56.062546Z'
ingestedAt: '2026-10-05T20:32:56.654Z'
epss: 0.00152
epssPercentile: 0.04295
---

## Overview

A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forged agent status, which can compromise data integrity.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Multicluster Engine for Kubernetes · no fix planned: Multicluster Engine for Kubernetes · updated 2026-10-05 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-71297.json)